Open-source hardware could defend against the next generation of hacking

Imagine you had a secret document you had to store away from prying eyes. And you have a choice: You could buy a safe made by a company that kept the workings of its locks secret. Or you could buy a safe whose manufacturer openly published the designs, letting everyone – including thieves – see how they're made. Which would you choose?

It might seem unexpected, but as an engineering professor, I'd pick the second option. The first one might be safe – but I simply don't know. I'd have to take the company's word for it. Maybe it's a reputable company with a longstanding pedigree of quality, but I'd be betting my information's security on the company upholding its traditions. By contrast, I can judge the security of the second safe for myself – or ask an expert to evaluate it. I'll be better informed about how secure my safe is, and therefore more confident that my document is safe inside it. That's the value of open-source technology.

Computer hardware is, for the most part, like the safe whose security mechanisms are secret. Any weaknesses are hidden, as well as any of their strengths. In the wake of revelations that Chinese spies may have been able to install a tiny computer chip inside devices used by as many as 30 companies, like Amazon and Apple, as well as the U.S. military and the CIA, I suggest re-evaluating the hardware people and corporations rely on to protect their secrets.

Hacking hardware is particularly dangerous because it can bypass even the most secure programming safeguards – like taking control of a server without needing a password at all. Hardware customers could benefit from the clear – if surprising – lesson the software industry has learned from decades of fighting prolific software hackers: Open-source systems can be more secure.

Open-source software isn't inherently or automatically more secure. But it creates more possibilities, and market pressure, for improving security. Just as when choosing a safe to store a secret document in, customers must decide – should they pick a system whose security is vouched for by the company that makes it, or a system that can be explored, examined and tested?

Open-source software users choose not to trust a program unless they can verify it independently. Many of them don't have the expertise themselves to be able to evaluate security claims, of course – but they can wait until consumer-protection groups do so independently, hire a verified expert to check things out, or even learn the skills needed to investigate for themselves. They could even decide to pay for a version of the software that has been checked out and is supported by experts.

Open-source hardware offers users the same choice. Many people who buy electronics have no idea what's inside them. Even technically sophisticated companies like Amazon have to hire outside forensic experts to be sure of exactly what is in the hardware their companies rely on.

Open-source hardware would mean each device's designs and components would be open for public view at any time. People could study the information, follow the directions to build a device, test it and distribute it – or even sell it. All that transparency would give attackers more data about their potential targets, for sure. But it would help customers downstream much more, by giving them the means to verify their own devices' security themselves.

Even open-source chips are gaining traction. It's already possible for people to build electronics that are open-source from the chips all the way up to the physical components. If hardware hacks become more common, that may be a key way for people to protect their cybersecurity. Companies and governments can also be expected to adopt policies that favor open-source hardware and require better testing to ensure their equipment is safe to use.

Citation:
Open-source hardware could defend against the next generation of hacking (2018, October 17)
retrieved 15 September 2019
from https://techxplore.com/news/2018-10-open-source-hardware-defend-hacking.html

This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no
part may be reproduced without the written permission. The content is provided for information purposes only.

E-mail the story

Open-source hardware could defend against the next generation of hacking

Note

Your email address is used only to let the recipient know who sent the email. Neither your address nor the recipient's address will be used for any other purpose. The information you enter will appear in your e-mail message and is not retained by Tech Xplore in any form.

Your Privacy

This site uses cookies to assist with navigation, analyse your use of our services, and provide content from third parties.
By using our site, you acknowledge that you have read and understand our Privacy Policy
and Terms of Use.